I have created the tables AuthItem,AuthAssignment and AuthItemChild and assigned roles as given in the yii rbac tutorials.
In my test controller when im using the following code it is giving me undefined constant.
TestController:
public function actionIndex()
{
$auth=Yii::app()->authManager;
if($auth->isAssigned(Yii::app()->user->role,Yii::app()->user->id))
{
ChromePhp::log(Yii::app()->user->role);
if(Yii::app()->user->checkAccess(‘createProfile’))
ChromePhp::log('allowed');
}
$this->render('index');
}
Here when the user who is admin logs in, i get to know that he is admin through Yii::app()->user->role but i am getting an error in the following line:
I want to clarify my doubt that CWebUser class has function: checkAccess($operation,$params=array(),$allowCaching=true), here its taking $operation as its parameters and in the above condition we are passing ‘Admin’ which is a role.
I took me quite long time to get how RBAC works. I like to use this example:
some profile (role)
/ | | \
read own | update own delete own (operators, a set for each model)
/ | | \
read create update delete (operators, a set for each model)
\ | | /
\ | | /
can do something (operator)
Now when you call checkAccess() on any of this auth item it traverses the tree upwards. When any auth item got a bizrule, it is evaluated and if it’s false checkAccess() stops following that branch.
When any item is assigned to a user, checkAccess() returns true.
Auth items should be connected in such way that more restrictive items are higher in the tree.
When assigning items to roles always try to choose the highest possible item (start with least amount of privileges).
When calling checkAccess() always try to choose the lowest possible item to avoid having multiple checkAccess() calls.
This is bad:
if (Yii::app()->user->checkAccess('read Model') || Yii::app()->user->checkAccess('read own Model'))
This is better:
if (Yii::app()->user->checkAccess('read Model'))
If you would assign ‘read own Model’ to a profile checking for ‘read Model’ will pass.
Now if you want an ‘Admin’ role, just assign all elements to it.
